bitybg[.]com

Analysis of bitybg.com indicates this domain was actively flagged as a phishing threat prior to being taken offline on July 25, 2026. Infrastructure review reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The site resolved to IP address 104.21.36.3, hosted on Cloudflare's network (AS13335), a common choice for threat actors seeking anonymity and DDoS protection. No SSL certificate was present, increasing the likelihood of interception or manipulation of user data. The domain's nameservers, jill.ns.cloudflare.com and noel.ns.cloudflare.com, are consistent with Cloudflare's infrastructure but offer no inherent trust indicators.

Detection data shows bitybg.com was blocked by three major security vendors: PhishDestroy, MetaMask, and SEAL. Scamadviser assigned a trust score of 40 out of 100, while Gridinsoft rated it 0 out of 100, both reflecting elevated risk. The domain appeared on three security blocklists, further corroborating its malicious classification. VirusTotal reported four detections out of 93 vendors, a modest but notable confirmation of its phishing status. The page title, '404 Not Found,' suggests the site may have been in a transitional state or intentionally stripped of content post-compromise, though the exact nature of the phishing scheme remains unconfirmed due to the lack of accessible page content.

Defenders should treat this domain as a confirmed phishing threat. Network-level blocks should be implemented for 104.21.36.3 and associated Cloudflare ranges, particularly for organizations using MetaMask or similar financial tools. Given the domain's recent registration and lack of legitimate indicators, it is unlikely to serve any valid purpose. Security teams are advised to monitor for related domains registered through NiceNIC or using identical Cloudflare nameservers, as these may indicate follow-up campaigns.